Extracted

• • Target

    138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4

  • Size

    5.8MB

  • MD5

    c685ca051d3ca0cdee08f5a33a548031

  • SHA1

    e2757e1edd96238202862ba5e7f926f5a3911e17

  • SHA256

    138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4

  • SHA512

    fea2bdfe6653a1cba5c97ce87a464e56dc9deb0ac44ce17fcf7ff741d1630e0193e16c787bb6d457c72b7da8ae7d3547ad18c953fb2aeed8c58c3a0a3d016527

  • SSDEEP

    98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2

  Score

  10^/10

  godfatherbankerinfostealerransomwaretrojanevasion

  • GodFather

    GodFather is an Android banking trojan targeting Turkish users first seen in March 2022.

    bankertrojaninfostealergodfather

  • Makes use of the framework's Accessibility service.

  • Acquires the wake lock.

  • Requests enabling of the accessibility settings.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3